Kepiye carane ngamanake sawijining GraphQL API saka query sing kasar?

Question

IT Interview Practice · Accepted Answer

Keluwesan sing gawe GraphQL kuat uga gawe iku dadi **permukaan DoS**: klien bisa nyarang query kanthi jero utawa njaluk daftar gedhe ing siji panggilan. Kowe mbela kanthi berlapis — **watesan jero, analisis kompleksitas/biaya, rate limiting, lan auth sing bener** — sing ora siji-sijia ditegakake basa query kanggo kowe.

## Ancamane: query tanpa wates

```graphql
# A malicious cyclic query: each level multiplies the work exponentially
query Bomb {
  user { friends { friends { friends { friends { name } } } } }
}
```

## Pertahanan

- **Watesan jero** — tolak query sing nyarang luwih jero tinimbang, umpamane, 7 tingkat. Garis pertahanan pisanan sing murah.
- **Analisis biaya/kompleksitas** — wenehi saben field biaya, timbang field list miturut argumen `first`-e, lan tolak sadurunge eksekusi yen total ngluwihi anggaran. Luwih kuat tinimbang jero mentah amarga iki nggatekake ambane list.
- **Rate limiting** — anggaran per-klien, luwih becik ing **biaya query** (dudu mung cacah request), supaya siji query larang diitung kaya akeh.
- **Persisted/allow-listed query** — ing produksi, mung tampa sakumpulan query sing wis kadhaptar; query ad-hoc sembarang ditolak, ngilangi umume vektor injeksi/DoS.

```js
import depthLimit from "graphql-depth-limit";
import costAnalysis from "graphql-cost-analysis";

const server = new ApolloServer({
  schema,
  validationRules: [
    depthLimit(7),                                  // block deep nesting
    costAnalysis({ maximumCost: 1000 }),            // block broad/expensive queries pre-execution
  ],
});
```

## Auth

Autentikasi sepisan (validasi token ing `context`), banjur **otorisasi per field/resolver** — aja tau percaya klien bakal ngilangi field. Lakoni pemeriksaan ing resolver utawa lapisan kaya GraphQL Shield, lan **aja tau nampilake schema introspeksi** utawa stack trace sing verbose ing produksi.

## Kenapa iki penting

Endpoint REST kanthi alami kawatesan; siji query GraphQL ora. Pewawancara senior pengin pola pikir **basis biaya** — jero iku perlu nanging ora cukup, analisis kompleksitas ditambah persisted query iku jawaban sanyatane — lan disiplin otorisasi per-resolver.

Ancamane: query tanpa wates

Pertahanan

Auth

Kenapa iki penting

Pitakon sing gegandhengan